fix(platform): unblock e2e seed in E2B sandboxes (#13054)

## Summary

Unblocks `test/e2e_test_data.py` running under the screenshot bot's E2B
sandbox, which previously **timed out at 15 minutes** every run. Two
independent issues, both fixed by this PR. End-to-end verified: seed
completes in ~23 s.

### 1. RabbitMQ concurrent-create race → `.erlang.cookie: eacces`

`docker compose --profile local up deps -d` brings ~12 containers up in
parallel. In E2B's Docker (Firecracker-backed), this triggers a race
that leaves `/var/lib/rabbitmq/.erlang.cookie` unreadable by the
in-container `rabbitmq` uid, crashing the broker with:

```
Error when reading /var/lib/rabbitmq/.erlang.cookie: eacces
```

First-principles diagnostics (injected into the bot's deps step) ruled
out:
- baked file in `rabbitmq:4.1.4` image (`/var/lib/rabbitmq/` is empty)
- stale anonymous volume (`docker volume ls` empty before+after `down
-v`)
- `RABBITMQ_ERLANG_COOKIE` env var (rabbit alone with the env var works)
- snapshot persistence (entrypoint-wrapper rm and tmpfs both ruled out —
race still hits)

The signal: `docker compose up rabbitmq -d` **alone** always works; the
failure only manifests when many containers are created concurrently. So
the race is at start-phase, and `depends_on: service_healthy` is the
right primitive.

**Fix**: add `depends_on: { rabbitmq: { condition: service_healthy } }`
to **`db` only**. Every other supabase service in the upstream compose
(`auth`, `meta`, `studio`, etc.) already has `depends_on: db:
service_healthy`, plus `migrate` does, so gating `db` on rabbit
transitively gates the bulk of the stack. This shrinks the concurrent
set rabbit starts with from 11 down to 6 (`redis-0/1/2`, `falkordb`,
`clamav`, `kong`) — enough to let rabbit win the race. Adds ~5 s to
first-time local startup; otherwise a no-op.

### 2. FalkorDB password resolved to empty string → broken auth

`docker-compose.platform.yml` previously used `environment:
REDIS_ARGS=--requirepass ${GRAPHITI_FALKORDB_PASSWORD:-}` — but
compose-level `${VAR}` interpolation only reads from the compose
project's `.env`, not the `backend/.env.default` loaded via `env_file`.
Result: `REDIS_ARGS` became `--requirepass ` (literal trailing-space
empty), and FalkorDB's `run.sh` choked parsing the args.

**Fix**: switch FalkorDB to use `<<: *backend-env-files` like every
other service, and wrap the entrypoint in a shell that expands the env
var at container-start time (where `env_file` vars are visible):

```yaml
entrypoint:
  - /bin/sh
  - -c
  - >-
    export REDIS_ARGS="--requirepass $${GRAPHITI_FALKORDB_PASSWORD:?GRAPHITI_FALKORDB_PASSWORD must be set}"
    && exec /var/lib/falkordb/bin/run.sh "$$@"
  - --
```

The `:?` (vs `:-`) fails the container with a clear error if the
variable is unset/empty, rather than silently producing `--requirepass
""` and surfacing every client connection as a confusing wrong-password
error. Addresses CodeRabbit's review comment.

Also drops the `wget --spider -q http://localhost:3000` portion of the
healthcheck: `wget` isn't installed in the falkordb image, so the check
always exited 127 → container forever reported `unhealthy`. The
redis-cli ping was the real readiness signal anyway.

`.env.default` now sets `GRAPHITI_FALKORDB_PASSWORD=local-dev-password`
(was empty). Without this, the entrypoint's `:?` assertion fails
immediately. This is the canonical place for default config — the
compose entrypoint asserts presence, `.env.default` provides the value.

## Verification

`/dev-screenshot` on commit `5056fe6f`, bot's deps step using plain
`docker compose --profile local down -v; up deps -d` (no bot-side
workaround):

| | |
|---|---|
| Setup | 11 min (mostly `docker compose build`) |
| Deps startup | `rabbitmq Started → Waiting × N → Healthy → db Started
→ meta/auth/migrate cascade → studio` |
| Real seed (`poetry run python test/e2e_test_data.py`) | **~23 s** ✅
(was 15 min timeout) |
| Bot QA review | **APPROVE**, findings `[]` |
| All 18 services | up + healthy |

## Diff

Net change vs `dev`:

```
.env.default                | 2 +-     1 line (FalkorDB password default)
docker-compose.platform.yml | 21 ++   FalkorDB env_file + entrypoint + fail-loud + healthcheck
docker-compose.yml          |  9 ++   db → rabbit:service_healthy (+docs)
3 files changed, 28 insertions(+), 4 deletions(-)
```

## Test plan

- [x] `/dev-screenshot` runs end-to-end with no bot-side workaround
- [x] Seed populates: 15 users, 376 graphs, 375 library agents, 61 store
submissions, 37 presets, 15 API keys
- [x] Local `docker compose --profile local up deps -d` still works
(rabbit→db ordering adds ~5 s)
- [ ] Sign CLA (pending)

## Notes for review / merge

The branch has 3 exploratory commits before the actual fix landed
(`e79eb9e` entrypoint-wrapper attempt, `1e7ab6d` tmpfs attempt,
`7757a8c` broad-deps version). Their effects are all undone in the final
tree. **Squash-merging is recommended** for a clean entry on `dev`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes local/CI Docker Compose orchestration (startup ordering and
service entrypoints), which can break developer environments if
misconfigured. It also introduces a non-empty default FalkorDB password
in `.env.default`, which could be accidentally reused outside local dev
if copied forward.
> 
> **Overview**
> Unblocks E2B/sandbox E2E seeding by **serializing startup** so `db`
waits for `rabbitmq` to be `service_healthy`, avoiding RabbitMQ boot
failures during concurrent container creation.
> 
> Hardens FalkorDB config in `docker-compose.platform.yml` by loading
env via `env_file`, setting `REDIS_ARGS` at container start with a
*fail-fast* `GRAPHITI_FALKORDB_PASSWORD` assertion, and simplifying the
healthcheck to a passworded `redis-cli ping`. `.env.default` now
provides a local-dev default for `GRAPHITI_FALKORDB_PASSWORD`.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
7273ed55255322214a6dffa032a12dfcfa5f1b8b. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>